Claims 

1. (Currently Amended) A method comprising: 
servicing a Web request from a Web application; 

associating a Web request Globally Unique Identifier (Web request GUID) with the Web 
request, wherein events which happen during servicing of the Web request can be 
identified by the Web request GUID, wherein the servicing comprises executing the 
Web application that and wherein the Web application interfaces with a server that is 
serv i c i ng services the Web request; 

detecting the occurrence of an event in the servicing of the Web request during the 
execution of the Web application , wherein a kernel trace session component of an 
operating system of the server performs event buffering to detect the occurrence of the 
event and traces are processed by a kernel of the operating system when the operating 
system processes a part of the Web request; 

logging by the server a server entry in a server trace log in response to the detecting of 
the occurrence of the event in the servicing of the Web request, wherein the server 
entry comprises: 

information descriptive of the occurrence of the event in the servicing of the Web 
request; 

a server event GUID corresponding to the event; and 
the Web request GUID corresponding to the Web request; 
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logging by the Web application an application entry having an application GUID in an 
application trace log, wherein each application entry is correlated with each server entry 
in the server trace log by a Web request GUID . and wherein at least one of the 
detecting and the loaaina are performed by one or more components of the operating 
system of the server : and 

determining which of the information that is descriptive of the occurrence of the event 
to put into the server entry or application entry, or both the server entry and the 
application entry, as appropriate, as a function of a predetermined level of verbosity 
selected from a plurality of levels of verbosity for the Web application and server. 

2. (Canceled) 

3. (Previously Presented) The method as defined in Claim 1, wherein the 
server entry is logged in the server trace log during the servicing of the Web request 
only when the event is selected from the group consisting of: 

the event pertains of the functionality of authentication; 
the event pertains of the functionality of security; 
the event pertains of the functionality of compression; 

the event pertains of the functionality of a Common Gateway Interface (CGI); and 
the event pertains of the functionality of one or more filters. 

4. (Currently Amended) The method as defined in Claim 1, wherein: 
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the server entry is logged in the server trace log during the servicing of the Web 
request only when the event pertains to a predetermined filter; and 
the information comprises data going into the predetermined filter and data coming out 
of the predetermined filter. 

5. (Canceled) 

6. (Canceled) 

7. (Currently Amended) The method as defined in Claim [[6]] 1, wherein: 
the server services the Web request from the Web application; 

the operating system of the server comprises one or more Application Program 
Interfaces (APIs); 

the Web application is executed by, or interfaces with, the server; 

the Web application interfaces with at least one said API to log a Web application event 

as a Web application entry in the server trace log; 

the Web application event occurs within the Web application itself; and 

the Web application entry comprises: 

information descriptive of the occurrence of the Web application event in the 

servicing of the Web request by the server when the Web application is running 

on, or interfacing with, the server; and 

the GUID corresponding to the Web request. 
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8. (Currently Amended) The method as defined in Claim 1, wherein [[:]] a 
server, hav i ng an opcrot i ng system, serv i ces the Web request from the Web 
app li cat i on; and at least one of the detecting and the logging are performed by one or 
more server applications that are executed by the server. 

9. (Currently Amended) The method as defined in Claim 8, wherein: 
the server serv i ces the Web request from the Web app li cat i on; 

the operating system of the server includes one or more APIs; 

the Web application is executed by, or interfaces with, the server; 

the Web application interfaces with at least one said API to log a Web application event 

as a Web application entry in the server trace log; 

the Web application event occurs within the Web application itself; and 

the Web application entry comprises: 

information descriptive of the occurrence of the Web application event in the 

servicing of the Web request by the server when the Web application is running 

on, or interfacing with, the server; and 

the GUID corresponding to the Web request. 

10. (Previously Presented) The method as defined in Claim 1, wherein filtering 
is performed on a URL basis, wherein each predetermined level of verbosity 
corresponds to a different number of data types available for use in logging application 
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entries and server entries, and wherein each data type corresponds to a different kind 
of data that is descriptive of the particular event. 

11. (Currently Amended) The method as defined in Claim 1, further comprising 
generating a report comprising at least a portion of the information in each said server 
entry or application entry, as appropriate, for which the Web request or server event 
GUID in the server entry or application entry, as appropriate, matches a supplied ID, 
wherein the amount of information in the report is a function of a predetermined level 
of verbosity selected from a plurality of levels of verbosity. 

12. (Currently Amended) The method as defined in Claim 11, wherein: 
each said server entry and each said application entry is in a binary format; and 

the generating of the report further comprises using an event GUID corresponding to 
each said event to map the binary format of each said server entry or a pplication entry, 
as appropriate, into an event description that is in a format that is human readable. 

13. (Currently Amended) The method as defined in Claim 1, wherein the Web 
request GUID or the event GUID is the first portion of the server entry or application 
entry . 
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14. (Currently Amended) The method as defined in Claim 1, wherein the Web 
request GUID is unique to the Web request with respect to other said Web requestsj 
and where i n and where i n . 

15. (Canceled) 

16. (Currently Amended) A computer-readable medium having stored thereon 
computer-executable instructions for perform i ng a method, the method . that when 
executed by a processor of a computing device, cause the computing device to perform 
acts comprising: 

associating a Web request Globally Unique Identifier (Web request GUID) with a Web 
request, wherein events which happen during servicing of the Web request can be 
identified by the Web request GUID, wherein the servicing comprises executing a Web 
application that interfaces with a server having an operating system and that is 
servicing the Web request; 

servicing the Web request with a server from a Web application that is executing on the 
server, wherein during the servicing multiple logger streams are simultaneously active 
to log the events as the Web request is being serviced by the server; 
detecting the occurrence of the events during the servicing of the Web request by the 
serve r, wherein a kernel trace session component of an operating system of the server 
performs event buffering to detect the occurrence of each event and traces are 
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processed bv a kernel of the operating system when the operating system processes a 
part of each Web request : 

logging by the server each of the events as server entries in a server trace log, wherein 
at least one of the detecting and the logging are performed by one or more 
components of the operating system of the server, and wherein each server entry 

comprises: 

information descriptive of the occurrence of an event; 

an event GUID corresponding to the event; and 

the Web request GUID corresponding to the Web request; 
logging by the Web application an application entry having an application GUID in an 
application trace log, wherein each application entry is correlated with each server entry 
in the server trace log by a Web request GUID; and 

determining which of the descriptive information to put into the server entry or 
application entry, or both the server entry and the application entry, as appropriate, as 
a function of a predetermined level of verbosity selected from a plurality of levels of 
verbosity for the Web application and server. 

17. (Canceled) 

18. (Previously Presented) The computer-readable medium as defined in Claim 
16, wherein the entry is logged in the server trace log during the servicing of the Web 
request by the server only when the event is selected from the group consisting of: 
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the event occurs within the context of a predetermined URL; 

the event pertains of the functionality of authentication; 

the event pertains of the functionality of security; 

the event pertains of the functionality of compression; 

the event pertains of the functionality of a CGI; and 

the event pertains of the functionality of one or more filters. 

19. (Previously Presented) The computer-readable medium as defined in Claim 
16, wherein the entry is logged in the server trace log during the servicing of the Web 
request by the server only when the event pertains to a predetermined filter, wherein 
the information comprises data going into the predetermined filter and data coming out 
of the predetermined filter. 

20. (Previously Presented) The computer-readable medium as defined in Claim 
16, wherein the method further comprises at least one of: 

activating the logging when the logging is deactivated; and 
deactivating the logging when the logging is activated. 

21. (Original) The computer-readable medium as defined in Claim 20, wherein 
the activating and the deactivating are performed remotely from the server. 
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22. (Previously Presented) The computer-readable medium as defined in Claim 
20, wherein the server trace log is in a remote location from the server. 

23. (Original) The computer-readable medium as defined in Claim 16, wherein at 
least one of the detecting and the logging are performed by one or more components 
of an operating system of the server. 

24. (Previously Presented) The computer-readable medium as defined in Claim 
23, wherein: 

the operating system of the server comprises one or more APIs; and 

the Web application interfaces with at least one said API for the logging of each said 

Web application event as an entry in the server trace log. 

25. (Canceled) 

26. (Previously Presented) The computer-readable medium as defined in Claim 

16, wherein: 

the operating system of the server comprises one or more APIs; and 

the Web application interfaces with at least one said API for the logging of each said 

Web application event as an entry in the application trace log. 
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27. (Previously Presented) The computer-readable medium as defined in Claim 
16, wherein the step of logging of the entry in the server trace log is in response to the 
detecting of the occurrence of the event in the servicing of the Web request. 

28. (Previously Presented) The computer-readable medium as defined in Claim 

16, where the method further comprises generating a report containing at least a 
portion of the information in each said entry for which the Web request GUID in the 
entry matches a supplied ID. 

29. (Previously Presented) The computer-readable medium as defined in Claim 
28, wherein: 

each said entry is in a binary format; and 

the generating of the report further comprises using the event GUID to map the binary 
format of each said entry into an event description that is in a format that is human 
readable. 

30. (Previously Presented) The computer-readable medium as defined in Claim 
16, wherein the Web request GUID is the first portion of the entry. 

31. (Previously Presented) The computer-readable medium as defined in Claim 
16, wherein the Web request GUID is unique to the Web request with respect to other 
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said Web requests, and wherein the Web request is for at least one of: a static file; a 
Common Gateway Interface (CGI); and an active server page (ASP). 

32. (Currently Amended) A system having a processor for tracing a Web 
request on a network, the system comprising: 

identifying means for identifying when a predetermined event occurs in a 
predetermined Web request when the predetermined Web request is being serviced^ 
wherein a kernel trace session component of an operating system of the system 
performs event buffering to detect the occurrence of the event and traces are 
processed by a kernel of the operating system when the operating system services a 

a logging means, in communication with the identifying means, for logging the event in 
a server trace log as the event happens, wherein the log of the event in the server 
trace log comprises: 

a GUID corresponding to the predetermined Web request; and 
information descriptive of the occurrence of the event when the predetermined 
Web request is being serviced, wherein the logging means is further for 
determining which of the information that is descriptive of the occurrence of the 
event to put into the server entry in the server trace log as a function of a 
predetermined level of verbosity, wherein the level of verbosity is selected from a 
plurality of verbosity levels; 



Serial No.: 10/798,819 

Atty Docket No.: MSI -1906US 

Atty/Agent: John C. Meline 



k}£^mies Trie Bus^nes^v of IP^ 



a second logging means, in communication with the identifying means, for logging the 

event in an application trace log after the event happens, wherein the logging of the 

event in the application trace log comprises: 

a GUID corresponding to the predetermined Web request; and 
information descriptive of the occurrence of the event when the predetermined 
Web request is being serviced, wherein the second logging means is further for 
determining which of the information to put into the application entry as a 
function of a predetermined level of verbosity, wherein the level is selected from 
a plurality of verbosity levels; and 

a correlation means for correlating each application entry with each server entry in the 

server trace log by a Web request GUID. 

33. (Currently Amended) A network environment comprising a server having a 
processo r, an operating system and multiple simultaneously active logger streams that 
are concurrently running on the server and that are each trace-enabled, the server 
servicing Web requests from a Web application while performing Web request-based 
tracing to produce traces in a server trace log that comprise a Web request GUID for 
each Web request and to flow each Web request GUID from the server across to the 
Web application, wherein the Web application produces traces in a Web application 
trace log, wherein the traces in the server trace log and the Web application trace log 
comprise information that is descriptive of events which occur during the servicing of 
the Web request by the server and the Web application, wherein the information in the 
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traces is determined in part as a function of a predetermined level of verbosity, wherein 
the level is selected from a plurality of levels of verbosity for the server and the Web 
application, [[and]] wherein the Web application eaft correlates each event in the Web 
application trace log with a server GUID from the server by a Web request GUID . and 
wherein a kernel trace session component of the operating system of the server 
performs event buffering to detect the occurrence of the events and traces are 
processed bv a kernel of the operating system when the operating system processes a 
part of each Web request . 

34. (Canceled) 

35. (Previously Presented) The network environment as defined in Claim 33, 
wherein the server returns each said trace from the multiple logger streams to a 
corresponding said trace-enabled Web application for which the Web request was 
serviced by the server. 

36. (Currently Amended) A server module operating on a server, the server 
module comprising: 

logic stored in a memory configured to service a Web request from a Web 
application operating on the server; 

logic , performed bv one or more components of an operating system of the 
server, configured to detect an occurrence of an event in the servicing of the Web 

Serial No.: 10/798,819 < jsst. 

Atty Docket No.: MSI -1906US " ' ^" lt^fJ«g^>aV^B Tlie BUS^rieSS Of I 

Atty/Agent: John C. Meline 



req ues t. the logic forming part of a kernel trace session component of the operating 
system of the server, the logic configured to perform event buffering to detect an event 
when traces are processed by the kernel when the operating system processes a part of 

looi c. performed by one or more components of the operatinc system of the 
server, configured to log a server entry in a server trace log, wherein the server entry 
comprises: 

information descriptive of the occurrence of the event of the servicing of 
the Web request; and 

a Web request Globally Unique Identifier (Web request GUID) 
corresponding to the Web request, wherein the Web request GUID is associated 
with the Web request, so that events which happen during servicing of the Web 
request can be identified by the Web request GUID which is logged with each of 
the events; and 

looi c. performed by one or more components of the operatinc system of the 
server, configured to log an application entry in an application trace log, wherein the 
a pplication entry comprises: 

information descriptive of the occurrence of the event of the servicing of 
the Web request; and 

a Web request GUID corresponding to the Web request; and 
logic configured to determine which of the information descriptive of the 
occurrence of the event to put into the server entry , the application entry, or both the 
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server entry and the application entry, as a function of a predetermined level of 
verbosity, wherein the verbosity is determined by selecting one of a plurality of discrete 
indices, the indices corresponding to human-readable labels, wherein the descriptive 
information of the event comprises an event GUID and human readable text, and 
wherein event GUIDs may be correlated with Web request GUIDs. 

37. (Canceled) 

38. (Currently Amended) The server module as defined in Claim 36, further 
comprising logic configured to limit the entries in the server trace log that correspond to 
a predetermined said event that is selected from the group consisting of: 

the event occurs within the context of a predetermined URL; 

the event pertains of the functionality of authentication; 

the event pertains of the functionality of security; 

the event pertains of the functionality of compression; 

the event pertains of the functionality of a CGI; and 

the event pertains of the functionality of one or more filters. 

39. (Currently Amended) The server module as defined in Claim 36, wherein: 
the entry is logged in the server trace log during the servicing of the Web request only 
when the event pertains to a predetermined filter; and 
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the information includes data going into the predetermined filter and data coming out 
of the predetermined filter. 

40. (Canceled) 
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